CVE-2021-47130 (GCVE-0-2021-47130)
Vulnerability from cvelistv5
Published
2024-03-15 20:14
Modified
2026-08-05 08:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvmet: fix freeing unallocated p2pmem
In case p2p device was found but the p2p pool is empty, the nvme target
is still trying to free the sgl from the p2p pool instead of the
regular sgl pool and causing a crash (BUG() is called). Instead, assign
the p2p_dev for the request only if it was allocated from p2p pool.
This is the crash that was caused:
[Sun May 30 19:13:53 2021] ------------[ cut here ]------------
[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!
[Sun May 30 19:13:53 2021] invalid opcode: 0000 [#1] SMP PTI
...
[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!
...
[Sun May 30 19:13:53 2021] RIP: 0010:gen_pool_free_owner+0xa8/0xb0
...
[Sun May 30 19:13:53 2021] Call Trace:
[Sun May 30 19:13:53 2021] ------------[ cut here ]------------
[Sun May 30 19:13:53 2021] pci_free_p2pmem+0x2b/0x70
[Sun May 30 19:13:53 2021] pci_p2pmem_free_sgl+0x4f/0x80
[Sun May 30 19:13:53 2021] nvmet_req_free_sgls+0x1e/0x80 [nvmet]
[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!
[Sun May 30 19:13:53 2021] nvmet_rdma_release_rsp+0x4e/0x1f0 [nvmet_rdma]
[Sun May 30 19:13:53 2021] nvmet_rdma_send_done+0x1c/0x60 [nvmet_rdma]
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2021-47130",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-03-18T15:12:36.061889Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-04T17:09:52.222Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-04T05:24:39.944Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/c440cd080761b18a52cac20f2a42e5da1e3995af"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/8a452d62e7cea3c8a2676a3b89a9118755a1a271"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/bcd9a0797d73eeff659582f23277e7ab6e5f18f3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c440cd080761b18a52cac20f2a42e5da1e3995af",
"status": "affected",
"version": "c6e3f13398123a008cd2ee28f93510b113a32791",
"versionType": "git"
},
{
"lessThan": "8a452d62e7cea3c8a2676a3b89a9118755a1a271",
"status": "affected",
"version": "c6e3f13398123a008cd2ee28f93510b113a32791",
"versionType": "git"
},
{
"lessThan": "bcd9a0797d73eeff659582f23277e7ab6e5f18f3",
"status": "affected",
"version": "c6e3f13398123a008cd2ee28f93510b113a32791",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.43",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.12.*",
"status": "unaffected",
"version": "5.12.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.43",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.12.10",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.13",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix freeing unallocated p2pmem\n\nIn case p2p device was found but the p2p pool is empty, the nvme target\nis still trying to free the sgl from the p2p pool instead of the\nregular sgl pool and causing a crash (BUG() is called). Instead, assign\nthe p2p_dev for the request only if it was allocated from p2p pool.\n\nThis is the crash that was caused:\n\n[Sun May 30 19:13:53 2021] ------------[ cut here ]------------\n[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!\n[Sun May 30 19:13:53 2021] invalid opcode: 0000 [#1] SMP PTI\n...\n[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!\n...\n[Sun May 30 19:13:53 2021] RIP: 0010:gen_pool_free_owner+0xa8/0xb0\n...\n[Sun May 30 19:13:53 2021] Call Trace:\n[Sun May 30 19:13:53 2021] ------------[ cut here ]------------\n[Sun May 30 19:13:53 2021] pci_free_p2pmem+0x2b/0x70\n[Sun May 30 19:13:53 2021] pci_p2pmem_free_sgl+0x4f/0x80\n[Sun May 30 19:13:53 2021] nvmet_req_free_sgls+0x1e/0x80 [nvmet]\n[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!\n[Sun May 30 19:13:53 2021] nvmet_rdma_release_rsp+0x4e/0x1f0 [nvmet_rdma]\n[Sun May 30 19:13:53 2021] nvmet_rdma_send_done+0x1c/0x60 [nvmet_rdma]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The buggy SGL alloc/free path is reached only from nvmet-rdma (`nvmet_rdma_map_sgl_keyed` \u2192 `nvmet_req_alloc_sgls` / `nvmet_rdma_release_rsp` \u2192 `nvmet_req_free_sgls`), which processes NVMe-oF commands from a remote RDMA/RoCE peer over the network.\nAC:L - In a p2pmem-enabled target deployment, an attacker who can issue I/O controls transfer size and concurrency and can force `pci_p2pmem_alloc_sgl()` to fail so the regular SGL fallback runs with `req-\u003ep2p_dev` still set; the subsequent free reliably hits `BUG()` in `gen_pool_free_owner()`.\nPR:N - At this vintage there was no DH-CHAP in-band auth, and with `allow_any_host` (a common nvmet config) any network peer can CONNECT and issue I/O; host NQN allowlisting alone is not a credential check, so this matches unauthenticated nvmet DoS scoring (e.g. CVE-2026-22998).\nUI:N - No victim user action is required once the NVMe target is configured and listening; the attacker only needs to connect and send I/O that exercises the p2pmem fallback path.\nS:U - Impact is a kernel BUG/oops in the same host kernel authority as the nvmet target; this is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:N - The defect frees a regular SGL through the p2pmem free path and terminates in `BUG()` when the address is not in the p2p gen_pool; it does not disclose kernel memory.\nI:N - This is a wrong-allocator free that hits an intentional `BUG()` rather than a use-after-free, OOB write, or other memory-corruption primitive usable for integrity compromise or code execution.\nA:H - Successful trigger causes `kernel BUG at lib/genalloc.c` (`gen_pool_free_owner`), producing a kernel oops/panic and denial of service of the target host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T08:46:12.154Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c440cd080761b18a52cac20f2a42e5da1e3995af"
},
{
"url": "https://git.kernel.org/stable/c/8a452d62e7cea3c8a2676a3b89a9118755a1a271"
},
{
"url": "https://git.kernel.org/stable/c/bcd9a0797d73eeff659582f23277e7ab6e5f18f3"
}
],
"title": "nvmet: fix freeing unallocated p2pmem",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2021-47130",
"datePublished": "2024-03-15T20:14:33.955Z",
"dateReserved": "2024-03-04T18:12:48.840Z",
"dateUpdated": "2026-08-05T08:46:12.154Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/c440cd080761b18a52cac20f2a42e5da1e3995af\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/8a452d62e7cea3c8a2676a3b89a9118755a1a271\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/bcd9a0797d73eeff659582f23277e7ab6e5f18f3\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:24:39.944Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.4, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47130\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-03-18T15:12:36.061889Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:18.322Z\"}}], \"cna\": {\"title\": \"nvmet: fix freeing unallocated p2pmem\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The buggy SGL alloc/free path is reached only from nvmet-rdma (`nvmet_rdma_map_sgl_keyed` \\u2192 `nvmet_req_alloc_sgls` / `nvmet_rdma_release_rsp` \\u2192 `nvmet_req_free_sgls`), which processes NVMe-oF commands from a remote RDMA/RoCE peer over the network.\\nAC:L - In a p2pmem-enabled target deployment, an attacker who can issue I/O controls transfer size and concurrency and can force `pci_p2pmem_alloc_sgl()` to fail so the regular SGL fallback runs with `req-\u003ep2p_dev` still set; the subsequent free reliably hits `BUG()` in `gen_pool_free_owner()`.\\nPR:N - At this vintage there was no DH-CHAP in-band auth, and with `allow_any_host` (a common nvmet config) any network peer can CONNECT and issue I/O; host NQN allowlisting alone is not a credential check, so this matches unauthenticated nvmet DoS scoring (e.g. CVE-2026-22998).\\nUI:N - No victim user action is required once the NVMe target is configured and listening; the attacker only needs to connect and send I/O that exercises the p2pmem fallback path.\\nS:U - Impact is a kernel BUG/oops in the same host kernel authority as the nvmet target; this is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\\nC:N - The defect frees a regular SGL through the p2pmem free path and terminates in `BUG()` when the address is not in the p2p gen_pool; it does not disclose kernel memory.\\nI:N - This is a wrong-allocator free that hits an intentional `BUG()` rather than a use-after-free, OOB write, or other memory-corruption primitive usable for integrity compromise or code execution.\\nA:H - Successful trigger causes `kernel BUG at lib/genalloc.c` (`gen_pool_free_owner`), producing a kernel oops/panic and denial of service of the target host.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c6e3f13398123a008cd2ee28f93510b113a32791\", \"lessThan\": \"c440cd080761b18a52cac20f2a42e5da1e3995af\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c6e3f13398123a008cd2ee28f93510b113a32791\", \"lessThan\": \"8a452d62e7cea3c8a2676a3b89a9118755a1a271\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c6e3f13398123a008cd2ee28f93510b113a32791\", \"lessThan\": \"bcd9a0797d73eeff659582f23277e7ab6e5f18f3\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/nvme/target/core.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.43\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.12.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.12.*\"}, {\"status\": \"unaffected\", \"version\": \"5.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/nvme/target/core.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/c440cd080761b18a52cac20f2a42e5da1e3995af\"}, {\"url\": \"https://git.kernel.org/stable/c/8a452d62e7cea3c8a2676a3b89a9118755a1a271\"}, {\"url\": \"https://git.kernel.org/stable/c/bcd9a0797d73eeff659582f23277e7ab6e5f18f3\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnvmet: fix freeing unallocated p2pmem\\n\\nIn case p2p device was found but the p2p pool is empty, the nvme target\\nis still trying to free the sgl from the p2p pool instead of the\\nregular sgl pool and causing a crash (BUG() is called). Instead, assign\\nthe p2p_dev for the request only if it was allocated from p2p pool.\\n\\nThis is the crash that was caused:\\n\\n[Sun May 30 19:13:53 2021] ------------[ cut here ]------------\\n[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!\\n[Sun May 30 19:13:53 2021] invalid opcode: 0000 [#1] SMP PTI\\n...\\n[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!\\n...\\n[Sun May 30 19:13:53 2021] RIP: 0010:gen_pool_free_owner+0xa8/0xb0\\n...\\n[Sun May 30 19:13:53 2021] Call Trace:\\n[Sun May 30 19:13:53 2021] ------------[ cut here ]------------\\n[Sun May 30 19:13:53 2021] pci_free_p2pmem+0x2b/0x70\\n[Sun May 30 19:13:53 2021] pci_p2pmem_free_sgl+0x4f/0x80\\n[Sun May 30 19:13:53 2021] nvmet_req_free_sgls+0x1e/0x80 [nvmet]\\n[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!\\n[Sun May 30 19:13:53 2021] nvmet_rdma_release_rsp+0x4e/0x1f0 [nvmet_rdma]\\n[Sun May 30 19:13:53 2021] nvmet_rdma_send_done+0x1c/0x60 [nvmet_rdma]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.43\", \"versionStartIncluding\": \"5.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.12.10\", \"versionStartIncluding\": \"5.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.13\", \"versionStartIncluding\": \"5.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:46:12.154Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2021-47130\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:46:12.154Z\", \"dateReserved\": \"2024-03-04T18:12:48.840Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-03-15T20:14:33.955Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…